                :session (assoc (req :session) :user-id (user :id))
                :body ""}))))))
 
+  (POST "/logout" req
+    {:status 200 :session nil}))
+
+(defroutes api-routes
   (POST "/auth" req
     (if-let [user-id (let [{:keys [email password]} (req :params)]
                        (when (and email password)
                          (db/with-conn (db/authenticate-user email password))))]
       {:status 200 :session (assoc (req :session) :user-id user-id)}
-      {:status 401}))
-  (POST "/logout" req
-    {:status 200 :session nil}))
+      {:status 401})))
 
 (defroutes resource-routes
   (resources "/"))

    (let [fail {:status 400 :headers {"Content-Type" "text/plain"}}]
      (cond
        (string/blank? password) (assoc fail :body "Must provide a password")

        (not (invites/verify-hmac hmac (str now token invite_id email))) (assoc fail :body "Invalid HMAC")

        (string/blank? invite_id) (assoc fail :body "Invalid invitation ID")

        ; TODO: be smarter about this
        (not (#{"image/jpeg" "image/png"} (:content-type avatar))) (assoc fail :body "Invalid image")


        :else
        (let [invite (db/with-conn (db/get-invite (java.util.UUID/fromString invite_id)))]

                                    :port 6379}})

(def app
  (routes
    (wrap-defaults
      (routes sync-routes api-routes)
      (-> api-defaults
          (assoc-in [:session :cookie-attrs :secure] (= (env :environment) "prod"))
          (assoc-in [:session :store] (carmine/carmine-store *redis-conf*
                                                             {:expiration-secs (* 60 60 24 7)
                                                              :key-prefix "lpchat"}))))
      (->
        (wrap-defaults
          (routes
            resource-routes
            site-routes)
          (-> site-defaults ; ssl stuff will be handled by nginx
              (assoc-in [:session :cookie-attrs :secure] (= (env :environment) "prod"))
              (assoc-in [:session :store] (carmine/carmine-store *redis-conf*
                                                                 {:expiration-secs (* 60 60 24 7)
                                                                  :key-prefix "lpchat"}))
              (assoc-in [:security :anti-forgery]
                {:read-token (fn [req] (-> req :params :csrf-token))})))
        wrap-edn-params)))

(defonce server (atom nil))

